Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services institution is designing a hybrid and multi-account network topology. The environment comprises 30 spoke VPCs divided equally across the us-east-1 and us-west-2 Regions, managed under a single organization in AWS Organizations. The network design must connect all spoke VPCs to an on-premises data center. The primary connection must be a high-speed AWS Direct Connect connection, with a backup path using AWS Site-to-Site VPN connections. Traffic from AWS to the on-premises data center must default to the Direct Connect link and automatically fail over to the VPN connections if the Direct Connect link becomes unavailable. The design must minimize administrative routing complexity and support transitive routing between all spoke VPCs and the on-premises network. Which TWO actions should the Solutions Architect take to implement this architecture? (Select TWO)

  1. Create an AWS Transit Gateway in each Region, peer the two Transit Gateways, and attach the local spoke VPCs to their respective local Transit Gateway. Associate a central AWS Direct Connect Gateway with both Transit Gateways using a Transit Virtual Interface (Transit VIF) for the Direct Connect connection.Answer
  2. Establish AWS Site-to-Site VPN connections from the on-premises customer gateway to each Transit Gateway. Configure BGP dynamic routing on both the Direct Connect and VPN paths, and advertise the on-premises IP ranges to AWS with a shorter AS path over the Direct Connect connection than over the VPN connections.Answer
  3. C
    Create a Private Virtual Interface (Private VIF) on the Direct Connect connection, associate it with the Direct Connect Gateway, and associate the Direct Connect Gateway directly with the spoke VPCs to allow direct transitive routing between the VPCs and the on-premises network.
  4. D
    Create a central Route 53 Private Hosted Zone (PHZ) in the management account, and configure VPC peering between all spoke VPCs to allow resolution of private DNS records without associating the PHZ with the spoke VPCs.
  5. E
    Deploy a single, non-redundant NAT Gateway in a central egress VPC, and configure the route tables of all spoke VPCs across all Availability Zones to route outbound internet traffic through this single gateway to reduce NAT Gateway charges.

Answer

The correct architecture requires creating an AWS Transit Gateway in each Region, peering them, attaching spoke VPCs, and associating a central AWS Direct Connect Gateway using a Transit Virtual Interface. For high availability with automatic failover, establish AWS Site-to-Site VPN connections and use BGP dynamic routing, prepending the AS path on the VPN path to ensure the Direct Connect connection is the preferred path.
The correct solution involves deploying AWS Transit Gateway in each Region, peering them, and connecting the spoke VPCs to their local Transit Gateway to provide scalable hub-and-spoke transitive routing. An AWS Direct Connect Gateway is associated with the Transit Gateways using a Transit VIF to establish the primary high-speed connection. To configure the automatic failover, AWS Site-to-Site VPN connections are established to the Transit Gateways, and BGP dynamic routing is configured on both paths. By prepending the AS path on the VPN advertisements, AWS will prefer the Direct Connect path for outbound traffic to on-premises, failing over to the VPN only if the Direct Connect link fails.

Step-by-Step Solution

1
Deploy AWS Transit Gateways in both Regions (us-east-1 and us-west-2) and peer them.
Establishes a hub-and-spoke transit network that allows inter-VPC and cross-region routing.
Transit Gateways provide centralized routing and scale efficiently to support 30 spoke VPCs.
2
Attach the local spoke VPCs to the Transit Gateway in their respective Regions.
Connects all 30 VPCs to the regional hubs.
Enables transitive routing between the spoke VPCs and the central transit network.
3
Associate a central Direct Connect Gateway with both Transit Gateways and create a Transit VIF.
Establishes the primary high-speed hybrid path between AWS and the on-premises datacenter.
Transit VIF is required to connect Direct Connect Gateway to Transit Gateways.
4
Establish AWS Site-to-Site VPN connections from the on-premises Customer Gateway to each Transit Gateway and configure BGP.
Creates the backup hybrid path.
Provides a secondary path over the public internet for redundancy.
5
Configure BGP routing by prepending the AS path on the VPN connection advertisements.
Ensures the Direct Connect path is preferred for outbound traffic, while the VPN path acts as a standby.
BGP path selection prefers shorter AS paths, ensuring automatic failover to VPN only when Direct Connect is down.

Key Concept

Designing highly available, scalable hybrid networks using AWS Transit Gateway, Direct Connect Gateway, and dynamic BGP routing with AS path prepending for automatic failover.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic